Heyoka Backdoor — Malware Profile

Heyoka Backdoor is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by Aoqin Dragon since at least 2013.

MITRE ATT&CK techniques (15)

• T1007 System Service Discovery
• T1027.013 Encrypted/Encoded File
• T1036.004 Masquerade Task or Service
• T1055.001 Dynamic-link Library Injection
• T1057 Process Discovery
• T1070.004 File Deletion
• T1071.004 DNS
• T1083 File and Directory Discovery
• T1120 Peripheral Device Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1204.002 Malicious File
• T1218.011 Rundll32
• T1547.001 Registry Run Keys / Startup Folder
• T1572 Protocol Tunneling
• T1680 Local Storage Discovery

Attributed threat actors

• Aoqin Dragon

Read the full analysis on IntelFusions